Search Images Maps Play YouTube News Gmail Drive More »
Sign in
Screen reader users: click this link for accessible mode. Accessible mode has the same essential features but works better with your reader.

Patents

  1. Advanced Patent Search
Publication numberUS7047563 B1
Publication typeGrant
Application numberUS 09/733,617
Publication dateMay 16, 2006
Filing dateDec 7, 2000
Priority dateDec 7, 2000
Fee statusPaid
Publication number09733617, 733617, US 7047563 B1, US 7047563B1, US-B1-7047563, US7047563 B1, US7047563B1
InventorsGregory Weber, Laurence Grant
Original AssigneeCisco Technology, Inc.
Export CitationBiBTeX, EndNote, RefMan
External Links: USPTO, USPTO Assignment, Espacenet
Command authorization via RADIUS
US 7047563 B1
Abstract
Command authorization may be accomplished using the RADIUS protocol by providing a user profile on the server for each user. This user profile may be transferred to a network device, such as a NAS, when the user initiates a NAS session. It may be stored in a local cache and accessed each time the user attempts to execute a command. The user profile may contain a command set defined by regular expressions which can then be used to determine whether or not the command should be authorized. The command may then be authorized or rejected based on the results of this determination. After the session is completed, the user profile may be purged from the cache. The present invention allows for a dramatic savings in the traffic associated with command authorization and allows command authorization to be accomplished using the RADIUS protocol, which increases flexibility and NAS security.
Images(3)
Previous page
Next page
Claims(18)
1. A method for authorizing a command from a user received at a network device separate and distinct from an Authentication, Authorization, and Accounting (AAA) server, the method including:
establishing an access control protocol session with the user;
receiving a user profile for the user at the network device from a AAA server, the user profile containing information regarding which commands the user is authorized to execute, the information including a command set described by regular expressions;
storing the user profile in a memory accessible by the network device;
receiving the command from the user;
comparing the command to said command set contained in said user profile; and
authorizing the command if the command is contained in said command set.
2. The method of claim 1, wherein the network device is a Network Access Server (NAS).
3. The method of claim 1, further including purging said user profile from said memory when said access control protocol session is terminated.
4. The method of claim 1, wherein said access control protocol session is a RADIUS session.
5. The method of claim 1, wherein said command set is a list of previously authorized commands.
6. The method of claim 1, wherein said command set is described by regular expressions.
7. An apparatus for authorizing a command from a user received at a network device separate and distinct from an Authentication, Authorization, and Accounting (AAA) server, the apparatus including:
a RADIUS session initiator;
a user profile receiver coupled to said RADIUS session initiator and coupled to a AAA server;
a memory containing a user profile having a command set;
a user profile storer coupled to said user profile receiver and said memory;
a command receiver;
a command set comparer coupled to said memory and to said command receiver; and
a command authorizer coupled to said command set comparer.
8. The apparatus of claim 7, wherein the network device is a Network Access Server (NAS).
9. The apparatus of claim 7, further including a user profile purger coupled to said memory.
10. The apparatus of claim 7, wherein said command set is a list of previously authorized commands.
11. The apparatus of claim 7, wherein said command set is described by regular expressions.
12. An apparatus for authorizing a command from a user received at a network device separate and distinct from an Authentication, Authorization, and Accounting (AAA) server, the method including:
means for establishing an access control protocol session with the user;
means for receiving a user profile for the user at the network device from a AAA server, the user profile containing information regarding which commands the user is authorized to execute, the information including a command set described by regular expressions;
means for storing the user profile in a memory accessible by the network device;
means for receiving the command from the user;
means for comparing the command to said command set contained in said user profile; and
means for authorizing the command if the command is contained in said command set.
13. The apparatus of claim 12, wherein the network device is a Network Access Server (NAS).
14. The apparatus of claim 12, further including means for purging said user profile from said memory when said access control protocol session is terminated.
15. The apparatus of claim 12, wherein said access control protocol session is a RADIUS session.
16. The apparatus of claim 12, wherein said command set is a list of authorized commands.
17. The apparatus of claim 12, wherein said command set is described by regular expressions.
18. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for authorizing a command from a user received at a network device separate and distinct from an Authentication, Authorization, and Accounting (AAA) server, the method including:
establishing an access control protocol session with the user;
receiving a user profile for the user at the network device from a AAA server, the user profile containing information regarding which commands the user is authorized to execute, the information including a command set described by regular expressions;
storing the user profile in a memory accessible by the network device;
receiving the command from the user;
comparing the command to said command set contained in said user profile; and
authorizing the command if the command is contained in said command set.
Description
BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to the field of network communications. More specifically, the present invention relates to authorizing individual commands in the Remote Authentication Dial In User Server (RADIUS) protocol.

2. The Background

The Remote Authentication Dial In User Server (RADIUS) protocol is an access control protocol used to provide Authentication, Authorization, and Accounting (AAA) services for various network devices, but especially for Network Access Servers (NASes). Most service providers utilize RADIUS, and it is also used commonly in the Enterprise market.

In RADIUS, when a client initiates a call to a NAS, username and password information is collected. This username and password information is then forwarded to a central AAA server. A single transaction with the server is used to both authenticate and authorize the user. A session may then be initiated. A session is an active connection between two devices. During the rest of the session, the user then may initiate commands, and accounting records may be sent to the AAA server indicating the beginning and end of the client session.

A need exists, however, for individual commands to be authorized by an AAA server. This would allow routers or NASes that are accessed by many different administrators performing different functions to operate more efficiently and securely. The RADIUS protocol does not currently support this type of command authorization. The Terminal Access Controller Access Control System (TACACS+) is an access control protocol that offers command authorization. TACACS+ is based on the Transmission Control Protocol (TCP) and provides for a transmission from the network device receiving the command to the AAA server to request authorization to execute the command. The AAA server then may access a stored profile to determine if the user has authorization to perform the command. Then the AAA server may send a transmission back to the network device via TACACS+ indicating the results of the determination regarding authorization.

This solution, however, has several drawbacks. First, each individual command must be authorized. This involves sending a request to the AAA server and waiting to receive a response each time a network device receives a command from a user, causing additional delays in authorizing commands. Also since TACACS+ is based on TCP, a total of 8 packets must be transmitted back and forth between the network device and the AAA server each time a command is authorized, causing additional network traffic.

Additionally, RADIUS is much more commonly used than TACACS+. Accordingly, a need exists for a way to implement command authorization in the RADIUS protocol.

SUMMARY OF THE INVENTION

Command authorization may be accomplished using the RADIUS protocol by providing a user profile on the server for each user. This user profile may be transferred to a network device, such as a NAS, when the user initiates a RADIUS session. It may be stored in a local cache and accessed each time the user attempts to execute a command. The user profile may contain a command set defined by regular expressions, which are used in pattern matching which can then be used to determine whether or not the command should be authorized. The command may then be authorized or rejected based on the results of this determination. After the session is completed, the user profile may be purged from the cache. The present invention allows for a dramatic savings in the traffic and execution time associated with command authorization and allows command authorization to be accomplished using the RADIUS protocol, which increases flexibility.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flow diagram illustrating a method for authorizing a command from a user in a network device in accordance with a specific embodiment of the present invention.

FIG. 2 is a diagram illustrating an example of a user profile in accordance with a specific embodiment of the present invention.

FIG. 3 is a block diagram illustrating an apparatus for authorizing a command from a user in a network device in accordance with a specific embodiment of the present invention.

FIG. 4 is a block diagram illustrating a network device in accordance with a specific embodiment of the present invention.

DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT

In the following description, a preferred embodiment of the invention is described with regard to preferred process steps and data structures. However, those skilled in the art will recognize, after perusal of this application, that embodiments of the invention may be implemented using at least one general purpose computer operating under program control and/or using a program storage device, and that modification of the general purpose computer to implement the components, process steps, and/or data structures described herein would not require undue invention.

In accordance with a specific embodiment of the present invention, the components, process steps, and/or data structures are implemented using software running on a network access server or other network device, such as a Cisco™ Gigabit Switch Router or a Cisco™ Universal Access Server. This implementation is not intended to be limiting in any way. Different implementations may be used and may include other types of operating systems, computing platforms, and/or computer programs. In addition, those of ordinary skill in the art will readily recognize that devices of a less general purpose nature, such as hardwired devices, devices relying on FPGA (field programmable gate array) or ASIC (application specific integrated circuit) technology, or the like, may also be used without departing from the scope and spirit of the inventive concepts disclosed herewith.

The present invention provides for command authorization in the RADIUS protocol by storing a user profile in a cache or memory at a network device, such as a NAS. This user profile is transmitted from the AAA server to the NAS when a RADIUS session is begun. Thereafter, any command issued by the user is first checked against a record in the user profile. The record contains information as to which commands the user is authorized to execute. The NAS may then determine whether to authorize the command based on the information in the record. When the session is completed, the user profile may be purged from the cache. This solution allows for command authorization via the RADIUS protocol without having to send packets to the AAA server each time a command is issued. Additionally, since RADIUS does not use TCP, the transmission between the AAA server and the NAS at the beginning of the session uses fewer packets than even a single command authorization in TACACS+.

FIG. 1 is a flow diagram illustrating a method for authorizing a command from a user in a network device in accordance with a specific embodiment of the present invention. At 100, a RADIUS session is initiated between the user and the network device. In a specific embodiment of the present invention, the network device is a NAS. At 102, a user profile for the user is received from an AAA server, the user profile containing information regarding which commands the user is authorized to execute. The user profile may take many different forms. In a specific embodiment of the present invention, the user profile contains a command set described by regular expressions. FIG. 2 is a diagram illustrating an example of a user profile in accordance with a specific embodiment of the present invention. A user name 200 may identify the user (here, oper1). A password 202 may indicate the user's password, which may be checked when establishing the session. A command set that the user is authorized to issue may be defined by one or more Basic or Extended Regular Expressions as defined by IEEE P1003.2. A series of attribute value pairs (AVPairs) 204, 206, 208 define the regular expressions for the command set. A regular expression is any simple expression that can be handled by a finite automaton. Generally, regular expressions may resemble broad set definitions (e.g., “run .*” indicating that all commands beginning with the word “run” are part of the set) or definitions using boolean operators on sets (e.g., set a+set b). In RADIUS, the AVPairs may be used to hold the expressions defining an authorized command set. AV Pair 204 indicates that the user may execute any show command, while AVPair 208 indicates that the user may execute any ping command. AVPair 206 indicates that the user may execute a telnet command, but only may telnet to IP addresses beginning with “10.14.0.”

Referring back to FIG. 1, at 104, the user profile may be stored in a cache. This cache may be local to the NAS or network device. This will allow access to the user profile without having to reestablish contact with the AAA server. At 106, the command is received from the user. Since the network device may be a NAS, or may be any other network device, the type and format of the available commands may include any number of choices. At 108, it is determined whether the command is authorized based on the information in the user profile for the user stored in the cache. This may include comparing the command to a command set contained in the user profile. The command set may be a list of authorized commands, or alternatively, may be described by regular expressions. At 110, the command may then be authorized or rejected based on the results of the determining. If the NAS is configured to authorize individual commands, then this cached command set will be consulted whenever a command execution attempt is made. If the user has abbreviated the command in any way, it is first expanded to its full form, then regular expression matching is performed against the cached command set definition. The command set may be cached for the remainder of the session, thus at 112, when the RADIUS session is terminated, the user profile may then be purged from the cache.

FIG. 3 is a block diagram illustrating an apparatus for authorizing a command from a user in a network device in accordance with a specific embodiment of the present invention. A RADIUS session initiator 300 initiates a RADIUS session between the user and the network device. In a specific embodiment of the present invention, the network device is a NAS. A user profile receiver 302 coupled to the RADIUS session initiator 300 receives a user profile for the user from an AAA server, the user profile containing information regarding which commands the user is authorized to execute. The user profile may take many different forms. In a specific embodiment of the present invention, the user profile contains a command set described by regular expressions.

A user profile storer 304 coupled to the user profile receiver 302 and to a cache 306 stores the user profile for the user in a cache. This cache may be local to the NAS or network device. This will allow access to the user profile without having to reestablish contact with the AAA server. A command receiver 308 receives the command from the user. Since the network device may be a NAS, or may be any other network device, the type and format of the available commands may include any number of choices. An authorized command determiner 310 coupled to the command receiver 308 and to the cache 306 determines whether the command is authorized based on the information in the user profile for the user stored in the cache. This may include comparing the command to a command set contained in the user profile using a command set comparer 312. The command set may be a list of authorized commands, or alternatively, may be described by regular expressions. A command authorizer 314 coupled to the authorized command determiner 310 may then be authorized or rejected based on the results of the determining. A user profile purger 316 coupled to the cache 306 may then purge the user profile when the RADIUS session is terminated.

FIG. 4 is a block diagram illustrating a network device in accordance with a specific embodiment of the present invention. Network Device 400 contains a processor 402, for executing instructions. A program storage device 404 may hold software containing instructions for executing the present invention. A memory store 406, such as random-access memory (RAM) may be utilized to temporarily store the instructions from the program storage device.

By utilizing the RADIUS protocol to perform command authorization, the present invention allows individual commands from users to be independently authorized or rejected while minimizing the traffic load on the system. This invention may also have specific usefulness in the burgeoning field of enterprise networking, where there are currently many users of TACACS+who might be better off utilizing a RADIUS-based system.

While embodiments and applications of this invention have been shown and described, it would be apparent to those skilled in the art having the benefit of this disclosure that many more modifications than mentioned above are possible without departing from the inventive concepts herein. The invention, therefore, is not to be restricted except in the spirit of the appended claims.

Patent Citations
Cited PatentFiling datePublication dateApplicantTitle
US5241594Jun 2, 1992Aug 31, 1993Hughes Aircraft CompanyOne-time logon means and methods for distributed computing systems
US5555376 *Dec 3, 1993Sep 10, 1996Xerox CorporationMethod for granting a user request having locational and contextual attributes consistent with user policies for devices having locational attributes consistent with the user request
US5655077Dec 13, 1994Aug 5, 1997Microsoft CorporationMethod and system for authenticating access to heterogeneous computing services
US5671354Feb 23, 1996Sep 23, 1997Hitachi, Ltd.Method of assisting server access by use of user authentication information held in one of servers and a method of assisting management user account for use of servers
US5684950Sep 23, 1996Nov 4, 1997Lockheed Martin CorporationMethod and system for authenticating users to multiple computer servers via a single sign-on
US5708780Jun 7, 1995Jan 13, 1998Open Market, Inc.Internet server access control and monitoring systems
US5715394Sep 20, 1996Feb 3, 1998Alcatel N.V.Method of supporting the management of a communications network, and network management facility therefor
US5812529Nov 12, 1996Sep 22, 1998Lanquest GroupMethod and apparatus for network assessment
US5815665Apr 3, 1996Sep 29, 1998Microsoft CorporationSystem and method for providing trusted brokering services over a distributed network
US5835727Dec 9, 1996Nov 10, 1998Sun Microsystems, Inc.Method and apparatus for controlling access to services within a computer network
US5845070Dec 18, 1996Dec 1, 1998Auric Web Systems, Inc.Security system for internet provider transaction
US5881225 *Apr 14, 1997Mar 9, 1999Araxsys, Inc.Security monitor for controlling functional access to a computer system
US5897635 *Jun 7, 1995Apr 27, 1999International Business Machines Corp.Single access to common user/application information
US5898780Oct 9, 1996Apr 27, 1999Gric Communications, Inc.Method and apparatus for authorizing remote internet access
US5933625Aug 30, 1996Aug 3, 1999Akira SugiyamaUnique time generating device and authenticating device using the same
US5944824 *Apr 30, 1997Aug 31, 1999Mci Communications CorporationSystem and method for single sign-on to a plurality of network elements
US5968116Aug 22, 1997Oct 19, 1999Intel CorporationMethod and apparatus for facilitating the management of networked devices
US5974453Oct 8, 1997Oct 26, 1999Intel CorporationMethod and apparatus for translating a static identifier including a telephone number into a dynamically assigned network address
US5987232Sep 9, 1997Nov 16, 1999Cadix Inc.Verification server for use in authentication on networks
US5991810Aug 1, 1997Nov 23, 1999Novell, Inc.User name authentication for gateway clients accessing a proxy cache server
US5991828Oct 7, 1997Nov 23, 1999Fujitsu LimitedSystem for automatically connecting portable device to network using network environment information including domain name of naming device and community name of network management protocol
US6006334May 1, 1997Dec 21, 1999International Business Machines Corp.Method and system for authentication over a distributed service to limit password compromise
US6009103Dec 23, 1997Dec 28, 1999Mediaone Group, Inc.Method and system for automatic allocation of resources in a network
US6011910Apr 8, 1997Jan 4, 20003Com CorporationSupporting authentication across multiple network access servers
US6021429Nov 18, 1996Feb 1, 2000Canon Information Systems, Inc.Network device which maintains a list of device addresses
US6021496Jul 7, 1997Feb 1, 2000International Business Machines CorporationUser authentication from non-native server domains in a computer network
US6026441Dec 16, 1997Feb 15, 2000At&T CorporationMethod for establishing communication on the internet with a client having a dynamically assigned IP address
US6044155Dec 23, 1997Mar 28, 2000Microsoft CorporationMethod and system for securely archiving core data secrets
US6047376Mar 19, 1997Apr 4, 2000Toshiba Information Systems (Japan) CorporationClient-server system, server access authentication method, memory medium stores server-access authentication programs, and issuance device which issues the memory medium contents
US6061650 *Sep 10, 1996May 9, 2000Nortel Networks CorporationMethod and apparatus for transparently providing mobile network functionality
US6065980Jun 29, 1998May 23, 2000Cisco Technology, Inc.Grounding a PCB to an enclosure sub-assembly using a grounding spring
US6081419Aug 3, 1998Jun 27, 2000Cisco Technology, Inc.Protection device for an electronic instrument and method
US6091951Sep 3, 1997Jul 18, 2000Telxon CorporationSeamless roaming among multiple networks
US6092196 *Nov 25, 1997Jul 18, 2000Nortel Networks LimitedHTTP distributed remote user authentication system
US6119160Oct 13, 1998Sep 12, 2000Cisco Technology, Inc.Multiple-level internet protocol accounting
US6141687 *May 8, 1998Oct 31, 2000Cisco Technology, Inc.Using an authentication server to obtain dial-out information on a network
US6182142 *Jul 10, 1998Jan 30, 2001Encommerce, Inc.Distributed access management of information resources
US6301618 *Sep 11, 2000Oct 9, 2001Cisco Technology, Inc.Forced sequential access to specified domains in a computer network
US6324648 *Dec 23, 1999Nov 27, 2001Gte Service CorporationSecure gateway having user identification and password authentication
US6463474 *Jul 2, 1999Oct 8, 2002Cisco Technology, Inc.Local authentication of a client at a network device
US6466977 *May 6, 1999Oct 15, 2002Cisco Technology, Inc.Proxy on demand
US6587433 *Feb 10, 1999Jul 1, 20033Com CorporationRemote access server for multiple service classes in IP networks
US6741853 *Nov 9, 2000May 25, 2004Nortel Networks LimitedDevice aware internet portal
WO1999053408A1Apr 14, 1999Oct 21, 1999Juno Online Services IncMethod and apparatus to control a client in a communications network
Non-Patent Citations
Reference
1"Cisco User Control Point", pp. 1-4, printed from http://www.cisco.com/warp/public/728/ucp ds.htm on Sep. 10, 1998.
2"IBM Introduces New Subscriber Management System for Internet Service Provider", Dec. 2, 1998, IBM Corporation, printed from http://www.cisco.com/univered/cc/td/doc/products/software/ios113ed/113t/113t3/ispec.
3"IPsec Network Security", pp. 1-69, printed from http://www.cisco.com/univercd/cc/td/doc/products/software/ios113ed/113t/113t3/ipsec.
4"L2TP", 1998, Mecklemedia Corporation, printed from http://www/webopedia.internet.com/TERM/L/L2TP/html.
5"MultiVPN from Ascend Communications: Breaking Down the Barriers to VPNs", Ascend Communications, Inc., White Paper, 1998.
6"Remote Access Network Security", Ascend Communications, Inc., printed from http://www.ascend.com/1103.html, on Jul. 24, 1998, pp. 1-8.
7Bellovin, Steven M., "Problem Areas for the IP Security Protocols", Jul. 22-25, 1996, Proceedings of the Sixth Usenix UNIX Security Symposium, San Jose, CA.
8Carrel, D. et al., The TACACS+Protocol, Version 1.78, Cisco Systems, Inc., printed from ftp://ftp-eng.cisco.com/edweber/tac-rfc.1.78.txt on Oct. 23, 2000.
9Cisco 6400 Access Concentrators, printed from http://www.cisco.com/warp.public/cc/pd/as6400/index.shtml on Sep. 27, 2000.
10Cisco 6400 Universal Access Concentrator, Data Sheet, printed from http://www.cisco.com/warp.public.cc.pd.as.6400.prodlit/6400<SUB>-</SUB>ds.htm on Sep. 27, 20000.
11Cisco 6400 Universal Access Concentrator, Product Bulletin-No. 1120, printed from http://www.cisco.com/warp.public.cc.pd.as.6400.prodlit/1120<SUB>-</SUB>pp.htm on Oct. 4, 2000.
12Cisco Asymmetric Digital Subscriber Line Services Architecture, White Paper, printed from http://www.cisco.com.warp.public/cc/so/neso/dsso/global/ads1<SUB>-</SUB>wp.htm on Sep. 27, 2000.
13Layer 2 Tunnel Protocol, Release 12.0(iI)T and 11.3(5)AA.
14Patel, B., et al., "Securing L2TP using IPSEC", May 1998, PPPEXT Working Group, pp. 1-10, printed from http://www.masinter.net/~12tp/ ftp/draft-ietf-pppext-12tp-security-02.txt.on Sep. 21, 1998.
15Rigney, et al., "Remote Authentication Dial In User Service (RADIUS) ", Network Working Group, RFC 2138, Apr. 1997, pp.1-57.
16Rosen, et al., "Multiprotocol Label Switching Architecture", Apr. 1999, Network Working Group, Internet-Draft, pp. 1-62.
17Tunneling, 1998, Meckermedia Corporation, printed from http://webopedia.internet.com/TERM/t/tunneling.html.
Referenced by
Citing PatentFiling datePublication dateApplicantTitle
US8000275 *Nov 15, 2002Aug 16, 2011Imerj, Ltd.Method for enabling an application recorded in a radiocommunication terminal to access functions of the terminal and terminal implementing said method
US8244837 *Nov 5, 2002Aug 14, 2012Accenture Global Services LimitedCentral administration of one or more resources
US8291096Sep 11, 2006Oct 16, 2012Accenture Global Services LimitedCentral adminstration of one or more resources
US8307406 *Dec 28, 2005Nov 6, 2012At&T Intellectual Property Ii, L.P.Database application security
US8566908Sep 14, 2012Oct 22, 2013AT&T Intellectual Propert II, L.P.Database application security
CN101106508BJul 14, 2006Jun 20, 2012华为技术有限公司A method for obtainment user specification in isomerous system
Classifications
U.S. Classification726/17, 714/E11.207
International ClassificationH04L9/00, H04L9/32, G06F11/30, G06F12/14
Cooperative ClassificationH04L63/102, H04L63/0892
European ClassificationH04L63/08K, H04L63/10B
Legal Events
DateCodeEventDescription
Nov 18, 2013FPAYFee payment
Year of fee payment: 8
Sep 28, 2009FPAYFee payment
Year of fee payment: 4
Mar 26, 2001ASAssignment
Owner name: CISCO TECHNOLOGY, INC., CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:WEBER, GREGORY;REEL/FRAME:011696/0684
Effective date: 20010216
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:GRANT, LAURENCE;REEL/FRAME:011696/0686
Effective date: 20010220